[Q] ftp connect troubles in passive mode

[Tony, Lim]

I have been operating ftp server to transfer math data with oversea vendors.

Till now, It works properly in active ftp mode.

However, from last month, our vendors claimed ftp connect troubles that connect timed out and refuse, so they had been needed more treatment and concerning.

Thay said ftp troubles happend sometimes, not always.

So, I found some solution in this forum and recommend vendor to use passive ftp connection.

At this time, vendor complaint they could not connect via passive mode.

I started to investigate and found curious things. I captured and attached that one.

refer attached GIF files.

Upper is connected from different subnet (122.237.xxx.yyy -> ftp server).

Below is connected from same subnet (152.149.xxx.yyy -> ftp server).

The result of help or passive command is diffent. could not find passive or PASV command in Upper views (different subnet).

Our vendors viewed the same upper image. so they said that they could not use passive ftp connection.

Does anyone know about this ftp troubles or experience to solve this one, please let me know...

What caused this troubles, how can solve this one, Why command revealed differently in help command.

Thanks in advance.

[Steven E. Protter]

Shalom Tony,

ined -l or configure /etc/inetd.conf for enhanced logging.

Have the client try and ftp connect while running this command:

tail -f /var/adm/syslog/syslog.log

You will get an error that we can use to recommend a solution.

SEP

[VK2COT]

Hello,

Several points that might help:

a) Are both subnets going through the same
router/firewall?

And what type of a firewall are you using?
Do you use an FTP proxy as well?

b) Are both subnets properly NAT-ed
(if applicable)?

c) Are HP-UX servers on these two subnets
using the same version of the FTP client
and are their O/S the same version?

d) In a passive connection, the FTP client
attempts to open the second data connection
based on what the remote FTP server specifies
(an IP and port).

In an active FTP connection, the FTP server attempts to open the second data connection.

Do, by any chance, the HP-UX servers
run some kind of firewalling as well?

Can you list ndd(1) parameters on both servers?

e) Is your default router for the first subnet responding to the ICMP (famous Dead
Gateway Detect)?

f) What are the firewall/router logs showing?

Together with the HP-UX system logs,
you should be able to start a good
debugging process.

Regards,

VK2COT

[Tor-Arne Nostdal]

Hi Tim.
You state that it happened "from last month"...
----
FTP Server/Client
----
Normally it's easier to find out whats causing you problems by looking at the changes that's been made...
New versions of FTP ?

If neither you or the partner have performed changes that should influence on this, the problem could lie in some place in the network.
----
General communication issue
----
Perhaps it could be an idea to reduce the MTU Size (package size).
I have seen various problems with WAN communication related to package size, and variable handling of this.

The result might be sporadic timeouts, drops, and hanging/terminated applications - "strange problems".

/Tor-Arne

[paolo barila]

How about your tcp_keepalive_interval, is it the default 7200000?

# ndd -get /dev/tcp tcp_keepalive_interval

if so, try a lower value n under your firewall timeout

# ndd -set /dev/tcp tcp_keepalive_interval n

Paolo